2011-03-31 185 views
-2

您的SQL语法有错误;检查对应于你的MySQL服务器版本在1号线sql语法错误

广东话使用附近“)”正确的语法手册似乎解决这个错误:

protected void Page_Load(object sender, EventArgs e) 
{ 
    if (Page.IsPostBack) 
    { 
     //It is a postback so check if it was by div click (NOT WORKING because the javascript isnt posting back) 
     string target = Request["__EVENTTARGET"]; 
     if (target == "DivClicked") 
     { 
      string id = Request["__EVENTARGUMENT"]; 
      //Call my delete function passing record id 
      using (OdbcConnection cn = new OdbcConnection("Driver={MySQL ODBC 3.51 Driver}; Server=localhost; Database=gymwebsite2; User=root; Password=commando;")) 
      { 
       cn.Open(); 
       using (OdbcCommand cmd = new OdbcCommand("DELETE FROM WallPosting WHERE idWallPosting="+id+")", cn)) 
       { 
        cmd.ExecuteNonQuery(); 
       } 
      } 

     } 
    } 
    string theUserId = Session["UserID"].ToString(); 
    PopulateWallPosts(theUserId); 
} 
+1

天哪!我当然希望'id'不是'1或1 = 1; DROP TABLE WallPosting; - ' – 2011-03-31 03:13:31

+0

:O你是什么意思? – 2011-03-31 03:23:28

+1

使用参数化查询,而不是直接从发布的表单中获取值。这是一个SQL注入漏洞,无需将查询参数化到数据库中。 – 2011-03-31 03:29:54

回答

5

你不需要关闭)为删除。

using (OdbcCommand cmd = new OdbcCommand("DELETE FROM WallPosting WHERE idWallPosting=" + id, cn)) 
{ 
    cmd.ExecuteNonQuery(); 
} 
+0

+1。很好找。 – NotMe 2011-03-31 03:12:52

2

这是因为你有一个额外的右括号

new OdbcCommand("DELETE FROM WallPosting WHERE idWallPosting="+id+")", cn)) 

尝试

new OdbcCommand("DELETE FROM WallPosting WHERE idWallPosting="+id, cn)) 
1
using (OdbcCommand cmd = new OdbcCommand("DELETE FROM WallPosting WHERE idWallPosting="+id, cn)) 

,应该是它,你有一个额外的支架

0

您要关闭一个)的时候你以前没有打开过(。 这应该可以解决问题。